CVE-2023-38207 — XML Injection (aka Blind XPath Injection) in Adobe Commerce

CWE-91 — XML Injection (aka Blind XPath Injection)4 documents4 sources

Severity

7.5HIGHNVD

EPSS

0.9%

top 24.15%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Adobe Commerce Magento Community-edition Adobe Commerce +1 more

Timeline

PublishedAug 9

Description

Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by a XML Injection (aka Blind XPath Injection) vulnerability that could lead in minor arbitrary file system read. Exploitation of this issue does not require user interaction.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶NVDadobe/commerce< 2.4.4+3

▶CVEListV5adobe/adobe_commerce2.4.4-p4

▶Packagistmagento/community-edition2.4.6-p1 — 2.4.6-p2+2

▶Packagistmagento/project-community-edition2.0.2

🔴Vulnerability Details

CVEList

Adobe Commerce XML Injection (aka Blind XPath Injection) Arbitrary file system read↗2023-08-09

▶

OSV

Magento Open Source allows XML Injection↗2023-08-09

▶

GHSA

Magento Open Source allows XML Injection↗2023-08-09

▶